Post Uniform Grant Guidance implementation from an auditor perspective Jeff Zeichner Patrick Smith
Agenda Uniform Grant Guidance review Challenges with UGG implementation SEFA Internal controls and compliance Questioned costs/audit findings Other developments
Uniform Grant Guidance Review
Uniform Guidance for Federal Awards Contents Subpart A, 200.XX - Acronyms and definitions Subpart B, 200.1XX - General provisions Subpart C, 200.2XX - Pre-federal award requirements and contents of federal award Subpart D, 200.3XX - Post federal award requirements Subpart E, 200.4XX - Cost principles Subpart F, 200.5XX - Audit requirements Appendix I - Notice of funding opportunity Appendix II - Contract provisions for non-federal entity contracts under federal awards Appendix III - Indirect (F&A) costs identification and assignment, and rate determination for institutions of higher education (IHEs)
Uniform Guidance for Federal Awards Contents - continued Appendix IV - Indirect (F&A) costs identification and assignment, and rate determination for nonprofit organizations Appendix V - State/local government and Indian tribe-wide central service cost allocation plans Appendix VI -Public assistance cost allocation plans Appendix VII - State and local government and Indian tribe indirect cost proposals Appendix VIII - Nonprofit organizations exempt from cost principles Appendix IX - Hospital cost principles Appendix X - Data collection form Appendix XI - Compliance supplement Appendix XII Award term and condition for recipient integrity and performance matters
Summary of Key Changes Establishes uniform administrative requirements, cost principles, and audit requirements for federal awards to non-federal entities Provides for federal agencies to approve alternative methods of accounting for salaries and wages based on achievement of performance outcomes Requires pass-through entities to provide an indirect cost rate to subrecipients Provides a de minimis indirect cost rate of 10% of modified total dfirect cost (MTDC) Raises audit threshold to $750,000 thus reduces audit burden for approximately 5,000 non-federal agencies while maintaining coverage of over 99%
Summary of Key Changes Prohibits federal awarding agencies from imposing additional or inconsistent requirements with some exceptions Provides for waiving certain compliance requirements on a case-by-case basis Contains a clear and robust section for definitions that is applicable to all nonfederal agencies Provides for federal awarding agencies to only apply more restrictive requirements to a class of federal awards or non-federal entities when: Approved by OMB Required by federal statutes or regulations Provides for federal awarding agencies to apply less restrictive requirements when making fixed amount awards Allows no exceptions for audit requirements
Effective Dates Federal agencies must implement policies and procedures by promulgating regulations to be effective December 26, 2014 Non-federal entities will need to implement the new administrative requirements and cost principles for all new federal awards made after December 26, 2014, and to additional funding to existing awards (referred to as funding increments) made after that date Non-federal entities wishing to implement entity-wide system changes to comply with the guidance after December 26, 2014, will not be penalized for doing so Audit requirements effective for fiscal years beginning on or after December 26, 2014 Early implementation of any of the audit provisions is not permitted
Definitions 200.21, Compliance Supplement Previously it was called the Circular A-133 Compliance Supplement and was included as Appendix B to Circular A-133. The Compliance Supplement will now be Appendix XI to Part 200 of the Uniform Grant Guidance. 200.23, Contractor Note that the term "vendor" as used in Circular A-133 (in contrast to a subrecipient) is no longer used. The term "contractor" is defined here and will be used instead of "vendor" going forward. See also section 200.330 in Subpart D which further discusses subrecipients versus contractors.
Definitions - continued 200.330, Subrecipient and contractor determinations. The non-federal entity may concurrently receive federal awards as a recipient, a subrecipient, and a contractor, depending on the substance of its agreements with federal awarding agencies and pass-through entities. Therefore, a pass-through entity must make case-by-case determinations whether each agreement it makes for the disbursement of federal program funds casts the party receiving the funds in the role of a subrecipient or a contractor. The federal awarding agency may supply and require recipients to comply with additional guidance to support these determinations provided such guidance does not conflict with this section. (a) Subrecipients. A subaward is for the purpose of carrying out a portion of a Federal award and creates a Federal assistance relationship with the subrecipient. See 200.92 Subaward. Characteristics which support the classification of the non- Federal entity as a subrecipient include when the non-federal entity: (1) Determines who is eligible to receive what federal assistance; (2) Has its performance measured in relation to whether objectives of a federal program were met; (3) Has responsibility for programmatic decision making;
Definitions - continued (4) Is responsible for adherence to applicable federal program requirements specified in the federal award; and (5) In accordance with its agreement, uses the federal funds to carry out a program for a public purpose specified in authorizing statute, as opposed to providing goods or services for the benefit of the pass-through entity. (b) Contractors. A contract is for the purpose of obtaining goods and services for the nonfederal entity's own use and creates a procurement relationship with the contractor. See 200.22 Contract. Characteristics indicative of a procurement relationship between the nongederal entity and a contractor are when the contractor: (1) Provides the goods and services within normal business operations; (2) Provides similar goods or services to many different purchasers; (3) Normally operates in a competitive environment; (4) Provides goods or services that are ancillary to the operation of the federal program; and (5) Is not subject to compliance requirements of the federal program as a result of the agreement, though similar requirements may apply for other reasons. (c) Use of judgment in making determination. In determining whether an agreement between a pass-through entity and another non-federal entity casts the latter as a subrecipient or a contractor, the substance of the relationship is more important than the form of the agreement. All of the characteristics listed above may not be present in all cases, and the pass-through entity must use judgment in classifying each agreement as a subaward or a procurement contract.
Definitions - continued 200.79, Personally Identifiable Information (PII) and 200.82, Protected Personally Identifiable Information These terms, which were not previously defined in grant guidance, are now defined. These definitions will be important to auditors and auditees as single audit reporting packages submitted under the new guidance will be publically available (with exceptions for Indian tribes) and the guidance states that auditors and auditees must ensure that no protected personally identifiable information is included in their respective parts of the reporting package.
Definitions - continued 200.80, Program Income A definition of program income, which was not previously defined in Circular A-133, is now defined. Program income means gross income earned by the non-federal entity that is directly generated by a supported activity or earned as a result of the federal award during the period of performance. Program income includes but is not limited to: income from fees for services performed, the use or rental or real or personal property acquired under federal awards, the sale of commodities or items fabricated under a federal award, license fees and royalties on patents and copyrights, and principal and interest on loans made with federal award funds. Interest earned on advances of federal funds is not program income. Except as otherwise provided in federal statutes, regulations, or the terms and conditions of the federal award, program income does not include rebates, credits, discounts, and interest earned on any of them.
Challenges with UGG Implementation
Single Audits Effective Date of UG Why are we still talking about effective date? Continued confusion and lots of questions! Common questions What date dictates when the auditor uses the Uniform Guidance audit requirements? How does the auditee determine the appropriate cost principles and administrative requirements to follow and why does it matter to the auditor? When I test federal awards subject to pre-uniform Guidance rules do I need to modify my audit report to refer to OMB Circular A-133? (The answer to this question is No!) Applicability of UG audit requirements based on the entity s fiscal year beginning date (and not any individual federal award dates)
Who Follows What Rule??? Auditees Auditors Old awards: Old OMB cost principles and administrative requirements (e.g., OMB Circulars A- 87, A-110, A- 122, etc.) New awards and incremental funding: Subpart D and E of the Uniform Guidance Certain sections of Subpart F (e.g., 200.508 through.512) For testing compliance: Auditors audit against the criteria that the auditee is required to follow For performing the audit: Subpart F of the Uniform Guidance There is no circumstance where the auditor would perform the audit under both OMB Circular A-133 AND the UG audit requirements.
Single Audits Agency Differences Agencies had to adopt the UG in own regulations where some were permitted to diverge from UG Need to understand whether agency differences will affect major program work Auditee needs to determine federal agency differences first since it relates to their compliance After determining major programs to test, auditors should determine whether any agency differences will affect audit procedures Make reasonable effort and document Access GAQC Agency Difference nonauthoritative tool which is GAQC best effort to identify where agencies have codified their UG implementation and any changes proposed/made since initial adoption of the UG
Procurement States will follow the same policies and procedures they use for procurements from non-federal funds (i.e., state procurement statutes). Other non-federal entities will follow the five procurement methods outlined in the guidance ( 200.320) including small purchase procedures which are subject to the Simplified Acquisition Threshold, micro-purchases, sealed bids, competitive proposals, and noncompetitive proposals. In general, the new procurement standards adopt the majority of the language used from Circular 102. Therefore, non-federal entities that are currently subject to Circular A-110 will likely be affected more significantly. All auditees should review these changes carefully to determine the impact on their procurement procedures, in particular those relating to procurement card programs.
Procurement Micro Purchases $3,000 Aggregate - $2,000 if it is for construction and subject to Davis- Bacon Act. There does not need to be quotations. Equitable distribution among qualified vendors Small Purchases Simple and informal procurement methods Not more than the simplified acquisition threshold - currently $150,000 Sealed Bids Price and rate quotations must be obtained from adequate number of qualified sources. Above simplified threshold greater than $150,000 Preferred for construction projects Must be publicly advertised
Procurement Competitive proposals Above simplified threshold currently $150,000 More than one source for proposal Usually used for fixed fee or cost reimbursement A written method of evaluation and selection. Award must go to most advantageous proposal Sole source Must meet at least one of the criteria Single source availability Public emergency Written request has been made and approved by federal or PTE Competition is determined to be inadequate
SEFA
Single Audits SEFA SEFA is critical; serves as the primary basis for major program determination Accuracy and completeness are critical factors Historically, audit quality studies and peer reviews have identified SEFA-related weaknesses Ensuring staff understand what is required for the SEFA, both by the auditee and auditor, is critical for a high-quality single audit Be careful! UG changed some of the requirements and added more
SEFA - presentation 200.510 Schedule of expenditures of federal awards. The auditee must also prepare a schedule of expenditures of federal awards for the period covered by the auditee's financial statements which must include the total federal awards expended as determined in accordance with 200.502 basis for determining federal awards expended. While not required, the auditee may choose to provide information requested by federal awarding agencies and pass-through entities to make the schedule easier to use. For example, when a federal program has multiple federal award years, the auditee may list the amount of federal awards expended for each federal award year separately. At a minimum, the schedule must: (1) List individual federal programs by federal agency. For a cluster of programs, provide the cluster name, list individual federal programs within the cluster of programs, and provide the applicable federal agency name. For R&D, total federal awards expended must be shown either by individual federal award or by federal agency and major subdivision within the federal agency. For example, the National Institutes of Health is a major subdivision in the Department of Health and Human Services. (2) For federal awards received as a subrecipient, the name of the pass-through entity and identifying number assigned by the pass-through entity must be included.
SEFA presentation (continued) (3) Provide total federal awards expended for each individual federal program and the CFDA number or other identifying number when the CFDA information is not available. For a cluster of programs also provide the total for the cluster. (4) Include the total amount provided to subrecipients from each federal program. (5) For loan or loan guarantee programs described in 200.502 basis for determining federal awards expended, paragraph (b), identify in the notes to the schedule the balances outstanding at the end of the audit period. This is in addition to including the total federal awards expended for loan or loan guarantee programs in the schedule. (6) Include notes that describe that significant accounting policies used in preparing the schedule, and note whether or not the auditee elected to use the 10% de minimis cost rate as covered in 200.414 indirect (F&A) costs.
Best Practice Tips: SEFA Considerations Start early Communicate auditor to auditee Contact pass-through entities as needed Reformat SEFA as necessary, in advance Understand auditor s dual responsibilities for testing SEFA and the importance of getting it right For purposes of providing in-relation-to reporting For purposes of compliance audit and testing major programs Can materially affect major program determination Use GAQC SEFA tools, including a disclosure checklist to review and test your SEFA (see next slide)
Best Practice Tips: Use Your SEFA Toolbox GAQC tools for SEFA Auditor practice aaids Audit Plan Supplement for SEFA Disclosure checklist for SEFA Auditor s report checklist for the in-relation-to opinion on SEFA Auditee Practice Aids Worksheet for identifying federal program information Auditee disclosure checklist for SEFA AICPA Audit Guide, Government Auditing Standards and Single Audits, includes chapter on SEFA considerations and has illustrations Make sure any changes identified during audit are incorporated into the final version
Single Audits Major Program Determination Historically audit quality problems have been noted in this area 200.518 of the UG defines the following 4 steps: Identify Type A programs Identify the low-risk Type A programs Identify high-risk Type B programs Determine major programs to audit Changes made by the UG have the potential to trip up everyone that is used to doing it the old way
UG Areas to Pay Particular Attention To Low-risk auditee considerations Be especially careful if auditee is using a special-purpose framework to prepare financial statements Considering the effect of large loan and loan guarantees on Type A/B threshold Hurdle criteria for low-risk Type A programs Professional judgment criteria limited - no inherent risk! Identifying high-risk Type B programs If you risk assess and find more high-risk Type B programs than you need, you will have to audit them. Careful planning is needed! Can consider inherent risk in Type B risk assessments Threshold changes (e.g., Type A/B, % coverage)
Type A threshold table Total Federal awards expended Type A/B threshold $750,000 to $25 million $750,000 $25 million to $100 million Total Federal awards expended times.03 $100 million to $1 billion $3 million $1 billion to $10 billion Total Federal awards expended times.003 $10 billion to $20 billion $30 million Over $20 billion Total Federal awards expended times.0015 The above table is from the Guidance 200.518 Major program determination, paragraph (b)(1)
Best Practice Tips: Major Program Determination Be sure that programs are aggregated correctly to ensure appropriate Type A/Type B categorization Pay special attention to clusters Be alert for potential changes to major programs, including Type A/Type B programs, if the SEFA changes between planning and concluding the audit If the auditor determines major programs during interim phase of audit, recalculate at the end. Determine percentage of coverage at the end of the 4-step process Recheck that all necessary Type A and Type B risk assessments were performed and documented
Best Practice Tips: SEFA and Major Program Determination Have more questions? Need more information? Access the no-cpe archive of the GAQC web event titled, Crucial First Steps: The Schedule of Expenditures of Federal Awards and Major Program Determination Includes key information about SEFA preparation and auditor responsibilities Case studies in determining major programs Common questions in both areas Detailed summary of resources available
Internal Controls and Compliance
Single Audits Internal Control Testing Historically audit quality feedback has shown a lack of auditor understanding and/or documentation in this area Recent single audit oversights confirm this is still a problem Under the UG, auditors must: Perform procedures to obtain an understanding of internal control over federal programs sufficient to plan the audit to support a low assessed level of control risk of noncompliance for major programs. Plan testing of internal control over the relevant compliance requirements for each major program Perform testing of internal control as planned Report on internal control over compliance
Internal Control Documentation Requirements AU-C 935, Compliance Audits, requires auditor to document: The risk assessment procedures performed, including those relating to gaining an understanding of internal control over compliance Responses to the assessed risk of material noncompliance, the procedures performed to test compliance, and the results of those procedures, including any test of controls over compliance Materiality levels and the basis on which they were determined How complied with the specific governmental audit requirements that are supplementary to Generally Accepted Auditing Standards and Government Auditing Standards Also, need to meet documentation requirements in AU-C 230, Audit Documentation and the Yellow Book (i.e., the experienced auditor concept )
Internal Control Documentation: Learn from Others Mistakes Peer review and federal agencies often note inadequate or missing audit documentation Not documenting an understanding of internal control over compliance that addresses the five elements of COSO or Green Book Not knowing the difference between operating effectiveness and determining that control has been implemented Evidence of who, when, what Evidence of only inquiry instead of a combination of procedures Dual-purpose testing does not separately identify compliance tests and controls tests Lack of documentation around evaluating results of test of controls
Best Practice Tips: Internal Control Over Compliance Be sure to come full circle on risk of material noncompliance Identify, assess, respond, evaluate Preliminary assessment of control risk may be facilitated through a checklist or narrative Internal controls should be continually re-evaluated throughout the audit process Understand the difference between testing controls and testing compliance Controls: What did entity do to ensure compliance? Compliance: Did entity comply?
Best Practice Tips: Internal Control over Compliance Testing compliance gives indirect evidence on controls, but cannot serve as the basis for assessing controls as operating effectively 2-step testing process 1. Controls are designed effectively and placed into operation 2. Key controls are operating effectively (low control risk) Important to identify and document the key controls to be tested Remember to consider Information Technology (IT) controls when evaluating design and when testing for operating effectiveness
Single Audits Compliance Testing Challenges with testing compliance due to effective date implementation of the UG cost principles and administrative requirements Some older awards tested using old rules as criteria and newer awards tested using the Uniform Guidance rules as criteria Use of Parts 3.1 and 3.2 of the Compliance Supplement CAUTION! Certain compliance areas are more difficult for both auditees and auditors Procurement Subrecipient monitoring Indirect costs Compensation personal services
Status of Procurement Grace Period Auditee must implement the procurement standards 2 full fiscal years after the effective date of the UG (i.e., 2 full fiscal years after December 26, 2014) A 12/31 year-end client has to implement procurement standards for its fiscal year beginning 1/1/17 (i.e., its 12/31/17 fiscal year-end) A 6/30 year-end client has to implement the UG procurement standards for its fiscal year beginning 7/1/17 (i.e., its 6/30/18 fiscal year-end) Must document decision in internal procurement procedures This is still an evolving area! Watch for future GAQC communications Source: 2 CFR 200.110(a) and Council on Financial Assistance Reform (COFAR) FAQ 200.110-6
Best Practice Tips: Compliance Testing Make sure audit documentation is clear about the criteria used to perform tests (i.e., the old rules versus the new UG rules) Use appropriate sample sizes (use CAM & AICPA GAS-SA Guide) and prepare documentation to support Ensure that compliance sample sizes are appropriately adjusted for results of internal control testing Make sure staff understand the nuances of some of the more difficult compliance areas Ensure staff have an appropriate understanding of when to use of Part 3.1 and Part 3.2 of the Compliance Supplement
Best Practice Tips: Internal Control and Compliance Testing Have more questions? Need more information? Access the no-cpe archive of the GAQC Web event titled, Uniform Guidance: Challenging Compliance Areas Includes key information including: Lots of detail on internal control over compliance responsibilities and potential pitfalls Digging in to the specifics of the challenging compliance areas Common questions in both areas
Audit Reports - Questioned Costs and Audit Findings
Audit Findings Increased the threshold for reporting known and likely questioned costs from $10,000 to $25,000 Requires that questioned costs be identified by CFDA number and applicable award number Requires identification of whether audit finding is a repeat from the immediately prior audit and if so the prior year audit finding number Provides that audit finding numbers be in the format prescribed by the data collection form
Single Audits Reporting Reporting in a single audit is complex; lots of opportunities for errors Areas of focus should include: Proper evaluation of findings Ensuring appropriate auditors reports issued and that illustrative report examples used are up-to-date Developing detailed findings that include all required elements Including both Yellow Book and Uniform Guidance requirements Preparing a Schedule of Findings and Questioned Costs (SFQC) that include required sections
Reporting Practice Issue GAQC article recently issued: Practice Issue Noted With Auditee Corrective Action Plan and Summary Schedule of Prior Audit Findings Tips Views of responsible officials element of an audit finding, does not meet the UG requirement for the auditee to prepare a corrective action plan (CAP) in a document separate from the SFQC The CAP and the summary schedule of prior audit findings (SSPAF) are required to address audit findings which includes Yellow Book findings While the preparation of the CAP and SSPAF are an auditee requirement, the federal desk review checklist for reviews of single audit reports includes questions on this topic Have auditees put CAP and SSPAF on their letterhead for clarity
Best Practice Tips: Audit Findings Write from the perspective of what the federal agency needs to know (more is better than less) Do not include protected personally identifiable information (PPII) Consider using a template to ensure all required elements are included Be specific, particularly in criteria and condition Compliance supplement is not appropriate criteria Do not include too much duplication in the descriptions of the condition, effect, and cause Be practical with recommendations Consider effective dates of UG and use the right criteria in describing the finding
Best Practice Tips: SFQC Educate staff about the importance of the SFQC Start with a blank pro forma of the SFQC Include a cold review of the SFQC and documentation of the major program determination For efficiency, ensure staff in the field use a findings template to capture all required elements Use illustrative SFQC in Chapter 13 of GAS-SA Guide as an example
Best Practice Tips: Reporting Utilize illustrative audit reports AICPA GAS-SA Audit Guide, Chapters 4 and 13 Review tips GAQC Web site (a sampling of reports available to the public) http://www.aicpa.org/interestareas/governmentalauditquality/pages/ default.aspx Click: Resources, then Illustrative Audit Reports Use of second reviewer Trace major programs in SFQC and data collection form (DCF to audit documentation) Ensure that SFQC and DCF reflect actual results of audit Audit reports = SFQC = DCF = Documentation
Other Developments
Single Audits Other Developments 2017 Compliance Supplement IMPORTANT NOTICE: As noted in GAQC Alert #341, the Office of Management and Budget (OMB) released the final 2017 OMB Audit Requirements, Appendix XI - Compliance Supplement (the Supplement) on August 17, 2017. It was only released on the OMB web site in one large PDF file that can be accessed at: (https://www.whitehouse.gov/sites/whitehouse.gov/files/omb/circulars/a133/2017 /Compliance_Supplement_2017.pdf). Since then, OMB informed the AICPA that it is unable to post the Supplement by the various individual sections as is customarily done due to current restrictions/limitations on OMB web site content. OMB anticipates that the earliest the individual Supplement sections can be posted by OMB is November 2017. Since many practitioners prefer accessing individual sections of the Supplement (versus one large PDF file), OMB asked whether the AICPA could post the individual sections until such time that OMB is able to publish it. Therefore, as a public service, the GAQC has posted the 2017 Supplement, broken down by individual sections, on this web page. https://www.aicpa.org/interestareas/governmentalauditquality/resources/singleaudit/ pages/final2017ombcs.aspx Looking for 2016 and prior compliance supplements? During the transition to the new administration, the former OMB web site was archived and is available to the public via https://obamawhitehouse.archives.gov/. To access previous editions of the Compliance Supplement and other OMB circulars, go to the former Grants Management Circular web page.
Single Audits Other Developments 2017 Compliance Supplement Department of Education (ED) Student Financial Assistance (SFA) Program ED has been pursuing an annual audit requirement of the SFA program (See GAQC Alert #324) o o ED memorandum extends previous guidance to fiscal year 2017 audits; auditees should contact their school participation division if SFA would be considered low risk (i.e., would not otherwise be audited as a major program) Most likely, an exception will be provided by ED ED adding a new section in 2018 Supplement on Securing Student Information for auditors to test o Based on requirements for colleges and universities to comply with the safeguards rule of the Gramm-Leach-Bliley Act (GLBA).
Single Audits Other Potential Developments Government-wide effort relating to CFDA numbers Another round of COFAR FAQs? More robust guidance on internal control over compliance? Procurement/micropurchase threshold Government-wide effort to reduce regulation and burden?
Single Audits Other Developments Federal Audit Clearinghouse (FAC) No major FAC developments expected for upcoming year Continue to use data collection form (DCF) issued in July 2016 for audits performed under the UG FAC planning to improve the search capability in the future (no exact timeframe at this time) Pilot project still ongoing to look at potential for the DCF to replace the SEFA GAQC is monitoring and will communicate any developments Want to know more? Listen to no-cpe archive of GAQC web event, The New Data Collection Form and Federal Audit Clearinghouse Update